Which versions of GoAccess are affected by CVE-2026-55768?

GoAccess real-time WebSocket server before version 1.11 is vulnerable to unauthenticated remote denial of service attacks via specially crafted frame payloads, causing process termination and loss of…. A patch is available.

How to fix or mitigate CVE-2026-55768?

Within 24 hours: Inventory all GoAccess deployments and identify instances running versions prior to 1.11, with particular attention to systems where WebSocket monitoring is publicly accessible or exposed to untrusted networks. Within 7 days: Restrict network access to the WebSocket server to trusted internal sources only via firewall rules; consider disabling the real-time WebSocket feature if not operationally critical; and deploy aggressive connection rate limiting to mitigate DoS impact. Within 30 days: Monitor upstream GoAccess releases for version 1.11 or later, validate patches in non-production environments, and execute staged deployment to all production systems.

GoAccess CVE-2026-55768

Q: What is the CVSS score of CVE-2026-55768?

CVE-2026-55768 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51305 HIGH

Memory Allocation with Excessive Size Value (CWE-789)

2026-07-30 GitHub_M

Authentication Bypass Goaccess Suse

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network attacker sends one crafted frame (AV:N/AC:L/PR:N/UI:N); impact is process crash only, so A:H with C:N/I:N and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 30, 2026 - 22:20 EUVD

Source Code Evidence Fetched

Jul 30, 2026 - 21:35 vuln.today

Analysis Generated

Jul 30, 2026 - 21:35 vuln.today

CVE Published

Jul 30, 2026 - 20:34 cve.org

HIGH 8.7

DescriptionCVE.org

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11.

AnalysisAI

Denial of service in GoAccess before version 1.11 allows an unauthenticated remote client to crash the built-in real-time WebSocket server by sending a crafted frame whose 64-bit extended payload length is truncated into a signed 32-bit field before the maximum-frame-size guard runs. The truncation lets the length check be bypassed, triggering an approximately 18-exabyte memory allocation request that fails and terminates the process. No public exploit identified at time of analysis, but the upstream fix commit and GitHub Security Advisory GHSA-5gm5-pvh2-wg46 confirm the root cause and remediation.

Technical ContextAI

GoAccess is a real-time web log analyzer that, when run with real-time HTML output, embeds a lightweight WebSocket server (src/websocket.c) to stream live statistics to browser clients. The flaw is an integer-narrowing bug corresponding to CWE-789 (Memory Allocation with Excessive Size Value): the WebSocket protocol permits 64-bit extended frame lengths, but WSFrame.payloadlen was declared as a signed 32-bit int. Incoming 64-bit lengths were assigned into this signed field, and the max_frm_size comparison in ws_get_frm_header() was performed after the value had already been narrowed and sign-mangled, so an attacker-chosen large length wrapped past the guard. The fix (commit ea74b87) widens payloadlen to uint64_t, casts wsconfig.max_frm_size to uint64_t in the comparison, and adds a second bound check in ws_realloc_frm_payload() before allocation.

RemediationAI

Vendor-released patch: upgrade to GoAccess 1.11, which is the fixed release identified in the advisory and description. The corrective changes are in commit ea74b87254d0adc675c087ff49bddd2d60dc01d5 (widening WSFrame.payloadlen to uint64_t and enforcing the max-frame-size bound before allocation); see the advisory at https://github.com/allinurl/goaccess/security/advisories/GHSA-5gm5-pvh2-wg46. If immediate upgrade is not possible, the most effective compensating control is to disable the real-time HTML WebSocket server (do not run with --real-time-html / -o report.html real-time mode), which removes the vulnerable code path entirely at the cost of losing live-streaming dashboards. Alternatively, restrict network access to the WebSocket listener (default port 7890) using a firewall or reverse proxy so only trusted clients can reach it, or terminate WebSocket connections at a proxy that enforces a sane maximum frame size; these limit but do not eliminate the exposure if a trusted network segment is itself hostile.